Online DFS

Cyber Security Technologies

Presentation of the
OnLine Digital Forensic Suite™

Next-generation software for investigations
of live computers in networks . . .

OnLineDFS Introduction - Proprietary & Confidential - Page 1

Focus

OnLine Digital Forensic Suite™ is
a software product
for the real-time investigation
of live, running systems in networks

Product Heritage
 Core technology developed with SBIR
funding from the US Air Force
 Productized for commercial market
 Patent pending


Intended Uses

Target Markets Target Applications
 Fortune 5000  Incident Response
Corporations  Insider Threat
 Government Agencies  External Threat
 Integrators  Compliance
 Service Providers  Information Assurance
 Law Enforcement  E-Discovery
 Criminal Investigations


OnLineDFS™ Deployment
Corporate System Under Investigation
Multi-User Version Depicted Headquarters
Servers
Investigator
(Browser interface)

Corporate Manufacturing Locations
NOC (or other secure location) Network

OnLineDFS Application
Any Location: & Data Store
• Corporate
• Field Location
• Law Enforcement
• Service Provider
• Home Office, Hotel, etc.
Note: Browser interface and System Under Investigation
OnLineDFS™ application can Regional
co-reside Offices
wired/wireless/mobile

System Under Investigation

OnLineDFS Today

 Volatile State Data  Memory  Persistent data
 29 sources of  Acquisition  Files, folders,
running state data directories,
 Examination
captured from metadata, etc.
Windows targets,  Search
 Unallocated and
similar with Unix  Registry
and Linux targets slack space
 Walk
 Acquisition  Capture, search
 Acquisition
 Examination  Image disk
 Search

Most volatile Persistent

Summary of OnLineDFS Functionality


Key Attributes

 Built for the examination of running systems
 Collects information that is lost when computer is shut down
 Strong emphasis on volatile data and live examination of persistent data for
rapid mitigation of risk
 “Plug-and-play” deployment
 OnLineDFS installed on network or subnet – no physical contact with target
system required
 No pre-installed agents
 Straightforward, simple architecture
 Simple set-up and operation
 Technology can be readily integrated with other technologies
 Investigate from anywhere, to anywhere
 Investigator can work where the application is, or remotely from anywhere
with Internet connectivity
 Investigations performed though secure network connection
 Wired/wireless/mobile targets OK
 Discreet, non-disruptive:
 Computer being analyzed is left in place
 No end-user involvement needed
 Investigative activity very difficult to detect
 Stable, solid product
 Release 3.6
 Designed to adhere to forensic best practices

4

OnLineDFS Advantages

 Designed for use in an enterprise environment
 Built for on-line, real-time, networked world
 Drill down live to hosts with issues of investigative interest
 Proactive tool to address issues as they are happening
 No pre-installed agents
 Plug-and-play product based on simple architecture,
very easy to deploy, maintain and use
 Discreet, unobtrusive, does not disrupt operations
 Flexible analytical approach fits real world
 Go where the data takes you, acquire what you need
 Enhances investigation productivity and timeliness
 Leverages investment in third-party tools
 Adheres to forensic best practices


OnLineDFS Delivers

Law Enforcement An effective tool for investigations
in an enterprise environment

Enterprises A cost-effective tool to mitigate
risk, conduct investigations
effectively

Service Providers A tool to deliver outstanding
customer timeliness and value


Volatile Data Acquisition


Memory and Registry


Persistent Data


Data Analysis


Primary Data and Search


Demonstration Scenario

 Network security has observed unusual traffic
on port 730 of host 192.168.171.202
 You are authorized to investigate this host and
have the and administrative account and
password necessary to perform the
investigation


Start the Investigation


Perform the Initial Acquire


Initial Acquire Completed


Let’s look at the Volatile Data


Look at Port 730 details


Let’s look at WINWORD


Dig Deeper


And Deeper


Acquire the WINWORD.exe


Acquire Completed


Let’s search within the acquired file


Search Completed with 5 matches


Let’s acquire memory


Background Task


Memory Acquire Completed


View Memory


Search for “Keylogger”


Search Results-Six Matches


Looks like a credit card entry


Let’s find the suspect


Start a new inquiry


Look at Port 1142


Have a look at Telnet


Search for credit card format


Let’s find Amazon


Same data- he is the bad guy


Comprehensive Documentation


Let’s Review the Investigation

 Acquired volatile data from host A
 Looked at port 730 details and found
WINWORD.exe
 Acquired the WINWORD.exe file
 Determined that it is a keylogger
 Acquired memory and found the keylogger
program and credit card data
 Referred back to the port 730 details and
identified the IP address and port of the host
connected to host A


Let’s Review the Investigation

 With this information, initiated a second
investigation on host B
 From the volatile data acquired, we identified
telnet as the process associated with port 1142
 Acquired memory and found the exact same
credit card data as was found in the memory of
host A
 Automatically generated detailed and
thorough documentation of the entire
investigation


Cyber Security Technologies

Questions?


Online DFS

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Online DFS

Similar to Online DFS (20)

More from Pablo Llanos Urraca

More from Pablo Llanos Urraca (9)

Recently uploaded

Recently uploaded (20)

Online DFS